Unable to use the Invoke-VMSCript cmdlet

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

When attempting to use the Invoke-VMScript cmdlet to run a script on the guest OS of a virtual machine it fails. It may fail outright, or you may get the following error: The 'propSet' paramter should not be null. The command may run successfully if ran by a user with the administrator role but fails with non-administrative permissions, but this is not generally best practice.

Giving the user read-only permissions to the parent datacenter and/or cluster objects will likely allow the script to run, as long as the "Propagate to children" box is checked. The problem with this, is that it may give the users access to virtual machines they should not have access to. Unchecking the "Propagate to children" box resolved this unmitigated access issue but also prohibits the Invoke-VMScript cmdlet from running properly. 

Environment

In your environment you may have configured the user with the correct permissions as noted below, and also found here: Invoke-VMScript Command | Vmware PowerCLI Reference

This Invoke-VMScript cmdlet runs a script in the guest OS of each of the specified virtual machines. To run Invoke-VMScript, the user must have read access to the folder containing the virtual machine and a Virtual Machine.Interaction.Console Interaction privilege. The virtual machines must be powered on and have VMware Tools installed and running. Network connectivity to the ESX system hosting the virtual machine must be present. To authenticate with the host or the guest OS, one of the HostUser/HostPassword (GuestUser/GuestPassword) pair and HostCredential (GuestCredential) parameters must be provided. The guest account you use to authenticate with the guest operating system must have administrator's privileges. For a list of supported operating systems, check the release notes of the specific VMware Tools version. To run this cmdlet against vCenter Server/ESXi 5.0 and later, you need VirtualMachine.GuestOperations.Modify and VirtualMachine.GuestOperations.Execute privileges.

Cause

The cause for this issue is being investigated. The Invoke-VMScript cmdlet may be running as designed, but the outcome doesn't necessarily match instructions here: Invoke-VMScript Command | Vmware PowerCLI Reference

 

Resolution

Apply the proper permissions as noted above for the user to the folder containing the virtual machines. Also give them read-only permission to the ESXi host where the virtual machines run and uncheck the box "Propagate to children". This will allow the users to run the Invoke-VMSCript against virtual machines in the specified folder and only allow the user to see the virtual machines in the folder they were given access to.